PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

under Art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC

(hereinafter referred to as the „GDPR“)

In case you are providing your personal data, we as a data controller (hereinafter referred to as the “HB Reavis” or “we”):

1. HB REAVIS HUNGARY Kft., having its registered seat at Népfürdő street 22. B. building. 3rd floor. Budapest, 1138, registration number: Cg. 01 09 876641,

2. HB REAVIS Construction Hungary Kft. having its registered seat at Népfürdő street 22. B. building. 3rd floor. Budapest, 1138, registration number: Cg 01 09 986093

3. KM Ingatlanbérbeadási Kft. having its registered seat at Népfürdő street 22. B. building. 3rd floor. Budapest, 1138, registration number: Cg. 01 09 331454

4. AGORA Budapest Kft. having its registered seat at Népfürdő street 22. B. building. 3rd floor. Budapest, 1138, registration number: Cg. 01 09 198895

would like to inform you about the processing of your personal data and of your rights related to the said processing.

HB Reavis is part of the HB Reavis Group, which consists of all entities consolidated under the group holding HB Reavis Holding S.A. with its headquarters in Luxembourg (hereinafter referred to as the “HB Reavis Group “) due to which the reference to HB Reavis Group may be found in the Privacy Notice.

What is our purpose and legitimate interests for the processing of your personal data?

1. Selection of potential employees.

2. Mutual communication.

3. Protection of property and safety of the employees and visitors.

4. Promotion of our events.

5. Sending of reminders.

Description of our purpose and legitimate interests:

1. In case of vacant position at HB Reavis, we look for the best fit to fill in this vacancy. When doing that, we collect the CVs from the applicants directly or from the third persons recommending the potential applicant. After reviewing the CVs of the applicants, we invite them for personal interviews after which we send the follow-up information. In case there is no vacant position at the time or if the applicant has not been successful at the particular job opening, we may, upon consent, store the CVs of these persons to contact them in the future regarding the job opening.

2. Our philosophy is to be open and transparent at all times. This includes being open to communication from any person interested in HB Reavis. To fulfill this goal, we created several types of contact forms which can be used to contact us. Additionally, we have also published emails of particular employees working for us, so you can contact them at any time with any question related to our building and business you may have. However, to ensure such effective, flawless and clear communication, we process some of your personal data.

3. Protection of our buildings and safety of people using our buildings are the key element and number one priority in our business activity. Being able to ensure the proper level of protection and safety, we installed video monitoring system (CCTV). When entering the buildings or are near of them, the CCTV might record you.

4. Furthermore, we may process your personal data by taking the photographs and audio-visual recordings, which are used for the purpose and legitimate interests of promotion of our events and services and to help us improve our brand and goodwill by providing you with our newsletters and follow-up marketing materials related to our events and publishing the photographs (where you can appear) and audio-visual recordings on our social media profiles such as YouTube, LinkedIn, Facebook, Twitter and Instagram and via other channels such as our websites

5. We also process your personal data for the purpose of sending reminders related to unsend webpage forms. Whenever you start filling out any webpage form published on our website, we automatically process the personal data you fill in. In some cases, you might forget to send the form, therefore we use the automatically saved personal data to remind you to finish filling out the form or to send the filled-out form.

What is our legal basis for the processing of your personal data?

1) If you send us your CV regarding the specific vacant position, we process your personal data on the basis of the performance of a contractual relationship and your request prior to entering into a contract under Article 6 (1) (b) of GDPR (in case of failure to provide us with the personal data, we cannot enter into a contract with you). If you want us to keep your CV after the recruitment process or without applying for any particular position, we process your personal data on the basis of a consent under Article 6 (1) (a) of GDPR.

2) If you contact us or any particular employee via e-mail or web-based form, we process your personal data on the basis of legitimate interests under Article 6 (1) (f) of GDPR.

3) We process your personal data on the basis of the legitimate interests under Article 6 (1) (f) of GDPR for the protection of our rights and interests and for ensuring security in our premises.

4) In case of promoting our events and services provided by us, we process your personal data on the basis of the legitimate interests under Article 6 (1) (f) of GDPR.

5) We process your personal data on the basis of legitimate interests under Article 6 (1) (f) of GDPR to send you reminders related to unsend webpage forms.

What kind of personal data do we process?

1) Personal data included in the CV (such as name, surname, date of birth, address, e-mail, phone number etc.).

2) Name, surname, e-mail address and phone number.

3) Audio-visual image of yourself.

4) Photograph or/and audio-visual image of yourself.

5) Personal data requested by the particular webpage form (such as name, surname, e-mail, phone number etc.)

How long do we store your personal data?

1) In case of applying for particular vacant position, we store your personal data until the end of the recruitment process. If you give us your consent to store your CV for future vacant positions, we store it for 2 years.

2) If you contact us or any employee via e-mail or web-based form, we store your personal data until you unsubscribe from our contact database.

3) In case of CCTV, we store your personal data for 15 days.

4) We store your personal data during the time strictly necessary to achieve the given purpose.

5) We store your personal data for 30 days.

As soon as we no longer need your personal data for the processing purposes for which the personal data have been collected, we will delete them unless the statute-barred period applies. Certain details and correspondence may be retained until the time limit for claims, in respect of the pre-contractual or contractual relationship, has expired or in order to comply with regulatory requirements regarding the retention of such personal data.

With whom do we share your personal data?

We may share your personal data within the companies in HB Reavis Group or with our business partners with which we have conducted an agreement as they are in position of processors, controllers or joint-controllers. We also may be obliged to provide your personal data to public authorities, in particular courts and law enforcement agencies (police and prosecutors) only to the extent necessary and within the limits of the law.

From whom do we get the personal data?

We get personal data from you.

Do we use automated individual decision-making?

No, we do not use automated individual decision-making.

Your personal data are processed within the territory of the Hungary and other states of the European Union. Your personal data can be processed by a country outside of European Union if this third country has been confirmed by the European Commission as a country with adequate level of data protection or if other appropriate data protection safeguards exist (for example, binding corporate privacy rules or EU standard data protection clauses).

Other information:

Personal data may also, in justified cases, be subject to use (processing) for the purpose of dealing with legal matters, including the performance of public authority obligations and monitoring for possible legal protection. Personal data may also be archived for a given public interest, as well as for scientific, historical or statistical research.

Your rights as a data subject are stated below. Please note that the exact conditions to exercise these rights are set out in detail in Chapter III of GDPR, while in a particular circumstance not all rights may be exercised. You have following rights:

• Access to personal data we process about you
• Rectification of incorrect or inaccurate personal data and add incomplete personal data
• Restriction, i.e. blocking of processing of your personal data
• The deletion of personal data in case the purpose absence or unauthorized data processing
• Submission of an objection to the processing of personal data if you believe that our data processing is not justified
• Be excluded from automated decision-making
• Listing of personal data in a structured and machine-readable format or for another controller
• Revocation of consent to the processing of personal data
• To lodge a complaint with the supervisory authority

Electronically: dataprivacy@hbreavis.com

In writing to the address:1138 Budapest, Népfürdő utca 22. B.ép. 3. Em.,

Telephone: +421 918 723 243

We strive to protect your privacy as much as possible and therefore we process your personal data in compliance with GDPR and all other relevant laws. However, if you disagree with the way we handle your personal data, you can exercise your rights via our Data Protection Officer at:

Data Protection Officer’s contact: Erika Wild, contact point at Twin City C, Mlynské Nivy 16, 821 09 Bratislava, Slovak Republic, tel. +421 918 723 243, email: dataprivacy@hbreavis.com

Or you can file a complaint in supervising authority regarding the processing of your personal data. Your local supervisory authority may be found at:

https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm